Privacy Policy

1. Introduction

Anything Green ("Anything Green", "AG", "we", "us" or "our") respects the privacy and confidentiality of personal information entrusted to us.

This Privacy Policy explains how Anything Green collects, receives, records, stores, uses, protects, discloses and otherwise processes personal information when you interact with our organisation, website, products and services.

This includes when you:

• visit or use our website;
• contact us by email, telephone or WhatsApp;
• submit an enquiry or service request;
• request a quotation or proposal;
• purchase or use our products or services;
• use our website chatbot or AI-assisted services;
• subscribe to communications from us;
• provide information during a profiling or vetting engagement;
• provide documents for digitisation;
• participate in a cybersecurity engagement; or
• otherwise provide personal information to Anything Green.

This Privacy Policy is designed with the requirements and principles of the Protection of Personal Information Act 4 of 2013 ("POPIA") in mind.

2. Who We Are

Anything Green is an information technology and solutions provider. Our services may include:

• Document Management;
• Document Digitisation;
• Qidenus Book Scanners and digitisation solutions;
• Website Design and Development;
• Company Compliance Services;
• Individual Profiling;
• Vetting Services;
• Penetration Testing and Cybersecurity Services;
• IT Infrastructure and Support;
• AI and technology solutions;
• Business and technical consulting; and
• other technology and information-management solutions.

For privacy purposes, Anything Green may act as a responsible party when determining the purposes and means of processing personal information.

Depending on the nature of an engagement, Anything Green may also process information on behalf of a client or another organisation. In those circumstances, the client may remain the responsible party and Anything Green may act as an operator or service provider.

3. Information Officer

Anything Green will designate an Information Officer in accordance with applicable South African law.

4. What Is Personal Information?

For purposes of this Privacy Policy, "personal information" generally means information relating to an identifiable, living natural person and, where applicable, an identifiable existing juristic person.

Depending on the circumstances, this may include:

• name and surname;
• identity or passport information;
• date of birth;
• gender;
• nationality;
• contact details;
• residential or business address;
• postal address;
• email address;
• telephone and mobile number;
• WhatsApp number;
• employment information;
• professional qualifications;
• financial or transactional information;
• documents supplied to us;
• photographs and images;
• voice recordings;
• device and browser information;
• IP address;
• website usage information;
• information relating to services requested;
• profiling and vetting information;
• cybersecurity information; and
• other information associated with an identifiable person or organisation.

We will only collect and process information that is reasonably necessary for a defined and legitimate purpose.

5. Special Personal Information

Certain categories of personal information receive additional protection under POPIA.

Depending on a specific engagement, information processed by Anything Green may potentially include information relating to:

• religious or philosophical beliefs;
• race or ethnic origin;
• trade-union membership;
• political persuasion;
• health or sex life;
• biometric information; or
• criminal behaviour, where applicable and lawfully processed.

Anything Green will not intentionally collect special personal information through ordinary website enquiries unless there is a lawful and appropriate reason to do so.

6. Children's Personal Information

Anything Green does not intentionally seek to collect personal information from children through ordinary website enquiries.

Where applicable law requires consent or another legal basis before processing a child's personal information, Anything Green will apply the required safeguards.

If a parent, guardian or authorised person believes that information relating to a child has been submitted unlawfully, they may contact us at info@anythinggreen.co.za .

7. How We Collect Personal Information

We may collect personal information directly from you when you:

• complete an online enquiry form;
• request a quotation;
• contact us by email;
• contact us by telephone;
• contact us through WhatsApp;
• communicate with us through social media;
• submit information through our website;
• interact with our chatbot;
• request a consultation;
• enter into an agreement with us;
• purchase products or services;
• provide information for profiling or vetting;
• provide documents for digitisation; or
• provide information during a cybersecurity engagement.

We may also receive personal information from third parties where permitted by law and where reasonably necessary for a legitimate business or service purpose.

8. Purposes for Which We Process Personal Information

Anything Green may process personal information for purposes including:

8.1 Enquiries and Consultations

Responding to enquiries, providing information and arranging consultations.

8.2 Quotations and Proposals

Preparing quotations, proposals, estimates and statements of work.

8.3 Contract Management

Establishing, administering and performing contractual relationships.

8.4 Service Delivery

Delivering requested products and services.

8.5 Document Management

Scanning, digitising, classifying, indexing, storing, retrieving and managing documents on behalf of customers.

8.6 Qidenus Solutions

Supplying, installing, configuring, maintaining and supporting Qidenus book-scanning and digitisation solutions.

8.7 Website Services

Designing, developing, maintaining, hosting, securing and supporting websites.

8.8 Company Compliance

Assisting customers with lawful business administration, registrations and compliance documentation.

8.9 Individual Profiling

Conducting profiling or information assessments where specifically requested and lawfully authorised.

8.10 Vetting Services

Conducting authorised vetting or background-information services using appropriate and lawful information sources.

8.11 Penetration Testing and Cybersecurity

Conducting authorised cybersecurity assessments, vulnerability assessments, penetration tests and security reviews.

8.12 Customer Support

Responding to technical problems, support requests and service issues.

8.13 Billing and Administration

Issuing invoices, processing payments and maintaining business records.

8.14 Security

Protecting our systems, networks, website and customers against fraud, abuse, cyberattacks and unauthorised access.

8.15 Legal and Regulatory Obligations

Complying with applicable legal, regulatory, contractual, tax, accounting, court and law-enforcement requirements.

8.16 Marketing

Communicating information about our products, services and business developments where permitted by law.

8.17 AI-Assisted Services

Operating and maintaining AI-assisted website functions, including chatbot and lead-generation functionality.

9. Lawful Processing

Anything Green will seek to process personal information in accordance with the conditions for lawful processing under POPIA.

Depending on the circumstances, processing may be based on:

• consent;
• performance of a contract;
• taking steps before entering into a contract;
• compliance with a legal obligation;
• protection of legitimate interests;
• performance of a public-law duty where applicable;
• protection of another person's legitimate interests; or
• another lawful basis recognised by applicable law.

10. Consent

Where Anything Green relies on consent, you may generally withdraw that consent, subject to applicable legal or contractual limitations.

Withdrawal of consent does not necessarily invalidate processing that occurred lawfully before withdrawal.

Requests to withdraw consent may be sent to: info@anythinggreen.co.za .

11. Data Minimisation

Anything Green seeks to limit personal information collected to information that is adequate, relevant and reasonably necessary for the identified purpose.

Where information is optional, you may generally choose whether to provide it. However, failure to provide information necessary for a service may prevent us from providing that service.

12. Accuracy of Personal Information

Anything Green will take reasonable steps to ensure that personal information in our possession is accurate, complete, not misleading and updated where necessary.

You may request correction or updating of personal information by contacting info@anythinggreen.co.za .

13. Information Obtained from Publicly Available Sources

Certain Anything Green services, particularly profiling, vetting and business-information services, may involve information obtained from publicly available sources.

Publicly available information may be incomplete, outdated, inaccurate, incorrectly attributed or changed after publication.

Accordingly, information obtained from public sources will not automatically be treated as verified fact.

Where appropriate, customers should independently verify information before relying on it for a significant decision.

14. Individual Profiling and Vetting

Where Anything Green is instructed to perform profiling or vetting services, additional safeguards may apply.

Depending on the engagement, this may include:

• identity information;
• contact information;
• professional information;
• company information;
• publicly available business information;
• publicly available online information;
• qualification information;
• directorship or business-association information;
• legally accessible records; and
• other information lawfully available for the specific purpose.

15. Automated Decision-Making and AI

Anything Green may use automated technologies, software tools or AI-assisted systems for:

• responding to website enquiries;
• classifying enquiries;
• identifying requested services;
• generating preliminary responses;
• routing leads;
• assisting customer support;
• analysing information;
• document classification;
• workflow automation; and
• other technology-related functions.

AI-generated or automated information may contain errors or omissions and should be independently verified where appropriate.

Unless expressly authorised and legally permitted, Anything Green will not rely solely on automated processing to make decisions that have significant legal or similarly substantial consequences for an individual.

16. Website Chatbot and AI Lead Generation

Our website may contain an AI-assisted chatbot or automated enquiry system.

The chatbot may collect:

• name;
• email address;
• telephone number;
• WhatsApp number;
• company name;
• service of interest;
• enquiry details; and
• information voluntarily supplied during the conversation.

The chatbot may be used to:

• answer general questions;
• identify customer requirements;
• recommend an appropriate AG service;
• collect enquiries;
• qualify leads;
• arrange follow-up; and
• route enquiries to the appropriate team.

17. Penetration Testing and Cybersecurity Data

Anything Green may process technical information during authorised cybersecurity engagements.

This may include:

• IP addresses;
• domains;
• network information;
• system information;
• vulnerability information;
• configuration information;
• usernames or account identifiers;
• security logs;
• application information;
• device information; and
• technical assessment results.

Penetration testing will only be performed within an agreed scope and with appropriate authorisation.

18. Document Management and Digitisation

Anything Green may process physical or electronic records on behalf of customers.

Documents may contain personal information belonging to customers, employees, clients, students, patients, members, suppliers, government officials, business partners or other individuals.

Where Anything Green processes documents on behalf of a customer, reasonable technical and organisational safeguards will be applied according to the nature of the information and agreed service.

19. Direct Marketing

Anything Green respects your right to object to direct marketing.

Electronic direct marketing will be conducted in accordance with POPIA and other applicable laws.

Where consent is required, appropriate consent will be obtained before sending direct marketing communications.

Marketing communications will identify the sender and provide a reasonable mechanism for requesting that future marketing communications cease.

To unsubscribe or object to marketing, email: info@anythinggreen.co.za .

20. WhatsApp Communications

Anything Green may use WhatsApp as a customer communication channel.

When you communicate with us through WhatsApp, your information may also be processed by WhatsApp/Meta in accordance with their own terms and privacy policies.

Anything Green does not control how third-party platforms process information within their own systems.

Customers should avoid sending highly confidential information through ordinary messaging platforms unless specifically instructed to do so.

21. Information Sharing and Disclosure

Anything Green will not sell personal information to third parties.

We may disclose or provide access to personal information where reasonably necessary for legitimate and lawful purposes, including to:

• employees and authorised personnel;
• contractors;
• professional advisers;
• accountants and auditors;
• legal advisers;
• IT service providers;
• hosting providers;
• cloud service providers;
• email service providers;
• payment service providers;
• cybersecurity providers;
• software providers;
• telecommunications providers;
• business partners where necessary;
• regulators;
• law-enforcement authorities where legally required;
• courts or tribunals; or
• other parties where disclosure is authorised or required by law.

22. Information Security

Anything Green takes reasonable technical and organisational measures to protect personal information against:

• loss;
• theft;
• unauthorised access;
• unauthorised disclosure;
• misuse;
• alteration;
• destruction;
• corruption;
• cyberattacks; and
• other unlawful processing.

Security measures may include:

• access controls;
• authentication;
• encryption;
• secure backups;
• network security;
• malware protection;
• monitoring;
• vulnerability management;
• physical security;
• role-based access;
• logging;
• staff awareness;
• confidentiality obligations; and
• incident-response procedures.

No electronic system can be guaranteed to be completely secure.

23. Security Incidents and Data Breaches

If Anything Green becomes aware of a security compromise involving personal information, we will assess the incident and take reasonable steps to:

1. contain the incident;
2. investigate the cause;
3. determine the information affected;
4. mitigate potential harm;
5. restore affected systems where appropriate;
6. document the incident;
7. take corrective measures; and
8. notify affected parties and/or the Information Regulator where required by law.

24. Data Retention

Anything Green will not retain personal information indefinitely without a lawful reason.

Personal information may be retained for as long as reasonably necessary to:

• provide services;
• fulfil contractual obligations;
• maintain business records;
• comply with legal requirements;
• resolve disputes;
• enforce agreements;
• protect our rights;
• maintain security records;
• satisfy accounting or tax requirements;
• maintain audit trails; or
• fulfil another legitimate and lawful purpose.

When personal information is no longer required, we will seek to securely delete, destroy, de-identify or otherwise dispose of it in accordance with applicable law and our records-retention practices.

25. Cookies and Website Technologies

Anything Green may use cookies and similar technologies to operate and improve its website.

Cookies may be used for:

• website functionality;
• remembering preferences;
• maintaining sessions;
• security;
• analytics;
• performance monitoring; and
• improving user experience.

Where non-essential cookies or tracking technologies are introduced, Anything Green will update its Cookie Policy and implement appropriate consent mechanisms where required.

Users may also manage cookies through their browser settings.

26. Links to Third-Party Websites

Our website may contain links to third-party websites, platforms or services.

Anything Green is not responsible for the privacy practices, security, content or policies of third-party websites.

Users should review the privacy policies of third-party websites before submitting personal information to them.

27. Cross-Border Processing

Some technology providers used by Anything Green may store or process information outside South Africa.

Where personal information is transferred across South African borders, Anything Green will seek to ensure that the transfer is permitted under applicable law and that appropriate safeguards are applied.

Depending on the circumstances, safeguards may include contractual protections, security measures, assessment of the receiving party, lawful consent or another mechanism permitted under POPIA.

28. Data Subject Rights

Subject to applicable law, a data subject may have rights including the right to:

• know whether personal information is being processed;
• request access to personal information held about them;
• request correction of inaccurate personal information;
• request deletion in appropriate circumstances;
• object to certain processing;
• object to direct marketing;
• withdraw consent where applicable;
• lodge a complaint concerning processing; and
• exercise other rights provided by POPIA or applicable legislation.

These rights are not absolute and may be subject to lawful limitations.

29. Requesting Access to Personal Information

To request access to personal information held by Anything Green, contact:

30. Correction or Deletion Requests

If you believe that personal information held by Anything Green is inaccurate, incomplete, outdated or misleading, you may request correction or updating.

Where legally permissible, you may also request deletion or destruction of personal information.

Requests should be sent to: info@anythinggreen.co.za .

We may retain information where retention is required or permitted by law.

31. Complaints

If you believe that Anything Green has processed your personal information unlawfully or otherwise infringed your privacy rights, please contact us first so that we can investigate the matter.

32. South African Information Regulator

A data subject may also lodge a complaint with the South African Information Regulator where appropriate.

33. Promotion of Access to Information Act (PAIA)

Anything Green recognises that the Promotion of Access to Information Act 2 of 2000 ("PAIA") may apply to requests for access to records held by the organisation.

Where required, Anything Green will maintain and make available an appropriate PAIA manual and information regarding how requests for records may be submitted.

A PAIA request is different from an ordinary request to access or correct personal information.

PAIA-related enquiries may be directed to:

Information Officer
Anything Green
info@anythinggreen.co.za

34. Changes to This Privacy Policy

Anything Green may amend this Privacy Policy from time to time.

Changes may reflect:

• changes in legislation;
• regulatory guidance;
• new services;
• new technology;
• changes to our website;
• changes to processing activities;
• changes to service providers; or
• improvements to our privacy practices.

The latest version will be published on the Anything Green website.

The "Last Updated" date at the beginning of this policy indicates when the policy was most recently revised.

35. Contact Details

For all privacy-related questions, requests, objections, corrections, complaints or enquiries, please contact Anything Green.

Declaration

Anything Green is committed to responsible information management and to protecting personal information entrusted to us.

We seek to process personal information lawfully, fairly and transparently, collect information for specific and legitimate purposes, limit unnecessary collection, maintain reasonable security safeguards and respect applicable data-subject rights.

This Privacy Policy should be read together with the Anything Green Terms and Conditions, Cookie Policy, POPIA notices, PAIA Manual, Information Security Policy, Data Retention Policy and applicable service agreements and confidentiality agreements.